Help with VLAN configuration please

Gwen93 · March 6, 2019, 8:38pm

This is my first time configuring Mikrotik.
I have a 4011 router and a CSR326 switch. I have tried to configure the VLANs as outlined in this http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1 but with limited success.

I have 4 Vlans on the switch, and I’m using SFP-SFPPLUS1 as the trunk between the switch and the router. Port 10 on the router is a MGMT port.
From VLAN Secure (10.6.10.0), on the CSR326 I can ping other hosts on that segment, but I can’t ping the gateway (10.6.10.1)
If I’m on VLAN MGMT, (port 10 on the router) I can ping Google and basically everything works from there.

I have included both the config from the router and the switch since I have no idea what is wrong.

If there is anything else required to help point me in the right direction, I’'l get it.

Thanks.

 mar/06/2019 15:11:44 by RouterOS 6.44
# software id = 2Z41-IHGR
#
# model = RB4011iGS+
/interface bridge
add frame-types=admit-only-vlan-tagged name=Bridge1 protocol-mode=none \
    vlan-filtering=yes
/interface vlan
add interface=Bridge1 name=Guest_VLAN vlan-id=30
add interface=Bridge1 name=IoT_VLAN vlan-id=20
add interface=Bridge1 name=MGMT_VLAN vlan-id=99
add interface=Bridge1 name=Secure_VLAN vlan-id=10
/interface ethernet switch port
set 0 default-vlan-id=0
set 1 default-vlan-id=0
set 2 default-vlan-id=0
set 3 default-vlan-id=0
set 4 default-vlan-id=0
set 5 default-vlan-id=0
set 6 default-vlan-id=0
set 7 default-vlan-id=0
set 8 default-vlan-id=0
set 9 default-vlan-id=0
set 10 default-vlan-id=0
set 11 default-vlan-id=0
/interface list
add name=WAN
add name=LAN
add name=VLAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=Secure_POOL ranges=10.6.10.200-10.6.10.254
add name=IoT_POOL ranges=10.7.20.200-10.7.20.254
add name=Guest_POOL ranges=10.6.30.150-10.6.30.254
/ip dhcp-server
add address-pool=Secure_POOL disabled=no interface=Secure_VLAN name=\
    Secure_DHCP
add address-pool=IoT_POOL disabled=no interface=IoT_VLAN name=IoT_DHCP
add address-pool=Guest_POOL disabled=no interface=Guest_VLAN name=Guest_DHCP
/interface bridge port
add bridge=Bridge1 frame-types=admit-only-vlan-tagged ingress-filtering=yes \
    interface=ether2
add bridge=Bridge1 frame-types=admit-only-vlan-tagged ingress-filtering=yes \
    interface=ether3
add bridge=Bridge1 frame-types=admit-only-vlan-tagged ingress-filtering=yes \
    interface=ether4
add bridge=Bridge1 frame-types=admit-only-vlan-tagged ingress-filtering=yes \
    interface=ether5
add bridge=Bridge1 frame-types=admit-only-vlan-tagged ingress-filtering=yes \
    interface=ether6
add bridge=Bridge1 frame-types=admit-only-vlan-tagged ingress-filtering=yes \
    interface=ether7
add bridge=Bridge1 frame-types=admit-only-vlan-tagged ingress-filtering=yes \
    interface=ether8
add bridge=Bridge1 frame-types=admit-only-vlan-tagged ingress-filtering=yes \
    interface=ether9
add bridge=Bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=ether10 pvid=99
add bridge=Bridge1 frame-types=admit-only-vlan-tagged ingress-filtering=yes \
    interface=sfp-sfpplus1
/ip neighbor discovery-settings
set discover-interface-list=none
/interface bridge vlan
add bridge=Bridge1 tagged="Bridge1,ether2,ether3,ether4,ether5,ether6,ether7,e\
    ther8,ether9,ether10,sfp-sfpplus1" vlan-ids=10
add bridge=Bridge1 tagged="Bridge1,ether2,ether3,ether4,ether5,ether6,ether7,e\
    ther8,ether9,ether10,sfp-sfpplus1" vlan-ids=20
add bridge=Bridge1 tagged="Bridge1,ether2,ether3,ether4,ether5,ether6,ether7,e\
    ther8,ether9,ether10,sfp-sfpplus1" vlan-ids=30
add bridge=Bridge1 tagged=Bridge1,sfp-sfpplus1 untagged=ether10 vlan-ids=99
/interface list member
add interface=ether1 list=WAN
add interface=MGMT_VLAN list=VLAN
add interface=Secure_VLAN list=VLAN
add interface=IoT_VLAN list=VLAN
add interface=Guest_VLAN list=VLAN
/ip address
add address=192.168.0.1/24 interface=MGMT_VLAN network=192.168.0.0
add address=192.168.44.6/24 comment="WAN connection to  Router" \
    interface=ether1 network=192.168.44.0
add address=10.6.10.1/24 interface=Secure_VLAN network=10.6.10.0
add address=10.7.20.1/24 interface=IoT_VLAN network=10.7.20.0
add address=10.6.30.1/24 interface=Guest_VLAN network=10.6.30.0
/ip dhcp-server network
add address=10.6.10.0/24 dns-server=192.168.0.1 gateway=10.6.10.1
add address=10.6.30.0/24 dns-server=192.168.0.1 gateway=10.6.30.1
add address=10.7.20.0/24 dns-server=192.168.0.1 gateway=10.7.20.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8
/ip firewall filter
add action=accept chain=input comment="Allow Estab & Related" \
    connection-state=established,related
add action=accept chain=input comment="Allow VLAN" in-interface-list=VLAN
add action=drop chain=input comment=Drop
add action=accept chain=forward comment="Allow Estab & Related" \
    connection-state=established,related
add action=accept chain=forward comment="VLAN Internet Access only" \
    connection-state=new in-interface-list=VLAN out-interface-list=WAN
add action=drop chain=forward comment=Drop
/ip firewall nat
add action=masquerade chain=srcnat comment="Default masquerade" \
    out-interface-list=WAN
/ip route
add distance=1 gateway=192.168.2.1
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www address=192.168.0.3/32
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/system clock
set time-zone-name=America/Toronto
/system identity
set name=William
/tool bandwidth-server
set enabled=no
/tool mac-server
set allowed-interface-list=none

Switch Config:

# jan/03/1970 00:06:44 by RouterOS 6.44
# software id = P6LR-WCGK
#
# model = CRS326-24G-2S+
/interface bridge
add name=Bridge1 protocol-mode=none vlan-filtering=yes
/interface vlan
add comment=MGMT_VLAN interface=Bridge1 name=MGMT_VLAN vlan-id=99
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/interface bridge port
add bridge=Bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=ether1 pvid=10
add bridge=Bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=ether2 pvid=10
add bridge=Bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=ether3 pvid=10
add bridge=Bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=ether4 pvid=10
add bridge=Bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=ether5 pvid=10
add bridge=Bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=ether6 pvid=10
add bridge=Bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=ether7 pvid=10
add bridge=Bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=ether8 pvid=10
add bridge=Bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=ether9 pvid=10
add bridge=Bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=ether10 pvid=10
add bridge=Bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=ether11 pvid=10
add bridge=Bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=ether12 pvid=10
add bridge=Bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=ether13 pvid=10
add bridge=Bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=ether14 pvid=10
add bridge=Bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=ether15 pvid=10
add bridge=Bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=ether16 pvid=10
add bridge=Bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=ether17 pvid=20
add bridge=Bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=ether18 pvid=20
add bridge=Bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=ether19 pvid=20
add bridge=Bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=ether20 pvid=20
add bridge=Bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=ether21 pvid=30
add bridge=Bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=ether22 pvid=30
add bridge=Bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=ether23 pvid=30
add bridge=Bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=ether24 pvid=30
add bridge=Bridge1 frame-types=admit-only-vlan-tagged interface=sfp-sfpplus1
/interface bridge vlan
add bridge=Bridge1 tagged=sfp-sfpplus1 untagged="ether1,ether2,ether3,ether4,e\
    ther5,ether6,ether7,ether8,ether9,ether10,ether11,ether12,ether13,ether14,\
    ether15,ether16" vlan-ids=10
add bridge=Bridge1 tagged=sfp-sfpplus1 untagged=\
    ether17,ether18,ether19,ether20 vlan-ids=20
add bridge=Bridge1 tagged=sfp-sfpplus1 untagged=\
    ether21,ether22,ether23,ether24 vlan-ids=30
add bridge=Bridge1 tagged=Bridge1,sfp-sfpplus1 vlan-ids=99
/ip address
add address=192.168.0.2/24 interface=MGMT_VLAN network=192.168.0.0
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www address=192.168.0.3/32
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/system identity
set name=Quagmire
/system routerboard settings
set boot-os=router-os

anav · March 7, 2019, 12:43am

Don’t worry, I still havent mastered the vlan thingy according to that link. I think it still has issues/warts to work out but it could just be me.
I took a quick look at the router config, my recommendations in blue…
I recommend you provide a diagram with notation, will help a lot.

/interface bridge
add name=Bridge1 protocol-mode=none
vlan-filtering=yes (do the ingress filtering on bridge ports, not here)
/interface vlan
add interface=Bridge1 name=Guest_VLAN vlan-id=30
add interface=Bridge1 name=IoT_VLAN vlan-id=20
add interface=Bridge1 name=MGMT_VLAN vlan-id=99
add interface=Bridge1 name=Secure_VLAN vlan-id=10

Get rid of all those switch port settings…

/interface list
add name=WAN
add name=LAN
add name=VLAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=Secure_POOL ranges=10.6.10.200-10.6.10.254
add name=IoT_POOL ranges=10.7.20.200-10.7.20.254
add name=Guest_POOL ranges=10.6.30.150-10.6.30.254
Where is management pool?
/ip dhcp-server
add address-pool=Secure_POOL disabled=no interface=Secure_VLAN name=
Secure_DHCP
add address-pool=IoT_POOL disabled=no interface=IoT_VLAN name=IoT_DHCP
add address-pool=Guest_POOL disabled=no interface=Guest_VLAN name=Guest_DHCP
where is management dhcp-server??
/interface bridge port
add bridge=Bridge1 frame-types=admit-only-vlan-tagged ingress-filtering=yes
interface=ether2
add bridge=Bridge1 frame-types=admit-only-vlan-tagged ingress-filtering=yes
interface=ether3
add bridge=Bridge1 frame-types=admit-only-vlan-tagged ingress-filtering=yes
interface=ether4
add bridge=Bridge1 frame-types=admit-only-vlan-tagged ingress-filtering=yes
interface=ether5
add bridge=Bridge1 frame-types=admit-only-vlan-tagged ingress-filtering=yes
interface=ether6
add bridge=Bridge1 frame-types=admit-only-vlan-tagged ingress-filtering=yes
interface=ether7
add bridge=Bridge1 frame-types=admit-only-vlan-tagged ingress-filtering=yes
interface=ether8
add bridge=Bridge1 frame-types=admit-only-vlan-tagged ingress-filtering=yes
interface=ether9
add bridge=Bridge1 frame-types=admit-only-untagged-and-priority-tagged
ingress-filtering=yes interface=ether10 pvid=99
add bridge=Bridge1 frame-types=admit-only-vlan-tagged ingress-filtering=yes
interface=sfp-sfpplus1
/ip neighbor discovery-settings
set discover-interface-list=none
/interface bridge vlan
(YOU HAVE ETH10 as an access bridge port for vlan99 above and thus cannot be tagged with vlan10 or vlan 20 or vlan 30 etc…)
add bridge=Bridge1 tagged=“Bridge1,ether2,ether3,ether4,ether5,ether6,ether7,e
ther8,ether9,sfp-sfpplus1” vlan-ids=10
add bridge=Bridge1 tagged=“Bridge1,ether2,ether3,ether4,ether5,ether6,ether7,e
ther8,ether9,sfp-sfpplus1” vlan-ids=20
add bridge=Bridge1 tagged=“Bridge1,ether2,ether3,ether4,ether5,ether6,ether7,e
ther8,ether9,sfp-sfpplus1” vlan-ids=30
IF there is NO difference between etherports 2-9 then why not
add bridge=Bridge1 tagged=Bridge1,ether2,ether3,ether4,ether5,ether6,ether7,e
ther8,ether9,sfp-sfpplus1" vlan-ids=10,20,30
add bridge=Bridge1 tagged=Bridge1,sfp-sfpplus1 untagged=ether10 vlan-ids=99
(Okay I see that vlan99 is going to the switch)
/interface list member
add interface=ether1 list=WAN
add interface=MGMT_VLAN list=VLAN
add interface=Secure_VLAN list=VLAN
add interface=IoT_VLAN list=VLAN
add interface=Guest_VLAN list=VLAN
/ip address
add address=192.168.0.1/24 interface=MGMT_VLAN network=192.168.0.0
add address=192.168.44.6/24 comment=“WAN connection to Router”
interface=ether1 network=192.168.44.0
add address=10.6.10.1/24 interface=Secure_VLAN network=10.6.10.0
add address=10.7.20.1/24 interface=IoT_VLAN network=10.7.20.0
add address=10.6.30.1/24 interface=Guest_VLAN network=10.6.30.0
/ip dhcp-server network
add address=10.6.10.0/24 dns-server=192.168.0.1 gateway=10.6.10.1 I prefer to have dns-server and gateway Identical, less confusing to look at LOL
add address=10.6.30.0/24 dns-server=192.168.0.1 gateway=10.6.30.1
add address=10.7.20.0/24 dns-server=192.168.0.1 gateway=10.7.20.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8
/ip firewall filter
add action=accept chain=input comment=“Allow Estab & Related”
connection-state=established,related
add action=accept chain=input comment=“Allow VLAN” in-interface-list=VLAN
(WHAT IS THE PURPOSE OF THIS RULE???)
I would break this down into
a. admin access to the router only!!
b. only other access required is DNS for vlans port 53, tcp, udp
add action=drop chain=input comment=Drop
add action=accept chain=forward comment=“Allow Estab & Related”
connection-state=established,related
add action=accept chain=forward comment=“VLAN Internet Access only”
connection-state=new in-interface-list=VLAN out-interface-list=WAN
Do you want admin access to all vlans???
add action=drop chain=forward comment=Drop
/ip firewall nat
add action=masquerade chain=srcnat comment=“Default masquerade”
out-interface-list=WAN
/ip route
add distance=1 gateway=192.168.2.1
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www address=192.168.0.3/32
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/system clock
set time-zone-name=America/Toronto
/system identity
set name=William
/tool bandwidth-server
set enabled=no
/tool mac-server
set allowed-interface-list=none

Switch Config:

Gwen93 · March 7, 2019, 1:34pm

Thank you, Anav. The config is like trying to write a sentence and you only know two letters.

I will go through this tonight to understand it and clean it up.

Thanks.

anav · March 7, 2019, 2:08pm

on the switch part you dont need any of the stuff being done by the router but you should be defining all the vlans.
They can have different names as long as the vlan Id is consistent.
The main difference I see between the two is that some of the switch ports will be trunk ports (from router or going to other managed switches) and access ports where devices are unable to tag packets. Otherwise I believe the setups should be fairly identical

Gwen93 · March 8, 2019, 1:04pm

I think I have it working now. I will compare the two configs this weekend and see what I did to make it work. I combined some config statements as you suggested Anav.

I managed to lock myself out of the switch so I learned how to reset it . Once I was there, I re-did everything @pcunite posted and it seems to be working fine.